rpm package
suse/docker&distro=SUSE Linux Enterprise Module for Containers 12
pkg:rpm/suse/docker&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2012
Vulnerabilities (49)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2021-30465 | — | < 20.10.9_ce-98.72.1 | 20.10.9_ce-98.72.1 | May 27, 2021 | runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on | ||
| CVE-2021-21334 | — | < 20.10.6_ce-98.66.1 | 20.10.6_ce-98.66.1 | Mar 10, 2021 | In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may | ||
| CVE-2021-21284 | — | < 19.03.15_ce-98.60.2 | 19.03.15_ce-98.60.2 | Feb 2, 2021 | In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesy | ||
| CVE-2021-21285 | — | < 19.03.15_ce-98.60.2 | 19.03.15_ce-98.60.2 | Feb 2, 2021 | In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing. | ||
| CVE-2020-15257 | — | < 19.03.14_ce-98.57.1 | 19.03.14_ce-98.57.1 | Dec 1, 2020 | containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified tha | ||
| CVE-2020-12912 | — | < 24.0.7_ce-98.103.1 | 24.0.7_ce-98.103.1 | Nov 12, 2020 | A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power Limit (RAPL) interface to show various side channel attacks. In line with industry partners, AMD has updated the RAPL interface to require pr | ||
| CVE-2020-8695 | — | < 24.0.7_ce-98.103.1 | 24.0.7_ce-98.103.1 | Nov 12, 2020 | Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access. | ||
| CVE-2020-8694 | — | < 24.0.7_ce-98.103.1 | 24.0.7_ce-98.103.1 | Nov 12, 2020 | Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. | ||
| CVE-2020-15157 | — | < 19.03.15_ce-98.60.2 | 19.03.15_ce-98.60.2 | Oct 16, 2020 | In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise | ||
| CVE-2020-13401 | — | < 19.03.11_ce-98.54.1 | 19.03.11_ce-98.54.1 | Jun 2, 2020 | An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain sensitive information, or cause a denial of service. | ||
| CVE-2019-19921 | — | < 20.10.6_ce-98.66.1 | 20.10.6_ce-98.66.1 | Feb 12, 2020 | runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vul | ||
| CVE-2014-8179 | — | < 1.8.3-49.1 | 1.8.3-49.1 | Dec 4, 2019 | Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation. | ||
| CVE-2014-8178 | — | < 1.8.3-49.1 | 1.8.3-49.1 | Dec 4, 2019 | Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands. | ||
| CVE-2019-16884 | — | < 19.03.5_ce-98.51.1 | 19.03.5_ce-98.51.1 | Sep 25, 2019 | runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory. | ||
| CVE-2019-14271 | — | < 19.03.1_ce-98.46.1 | 19.03.1_ce-98.46.1 | Jul 29, 2019 | In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container. | ||
| CVE-2019-13509 | — | < 19.03.1_ce-98.46.1 | 19.03.1_ce-98.46.1 | Jul 18, 2019 | In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non | ||
| CVE-2018-15664 | — | < 18.09.6_ce-98.40.1 | 18.09.6_ce-98.40.1 | May 23, 2019 | In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do | ||
| CVE-2019-5736 | — | < 18.09.1_ce-98.34.2 | 18.09.1_ce-98.34.2 | Feb 11, 2019 | runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new conta | ||
| CVE-2019-6486 | — | < 18.09.6_ce-98.37.1 | 18.09.6_ce-98.37.1 | Jan 24, 2019 | Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks. | ||
| CVE-2018-16875 | — | < 18.09.1_ce-98.34.2 | 18.09.1_ce-98.34.2 | Dec 14, 2018 | The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates |
- CVE-2021-30465May 27, 2021affected < 20.10.9_ce-98.72.1fixed 20.10.9_ce-98.72.1
runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on
- CVE-2021-21334Mar 10, 2021affected < 20.10.6_ce-98.66.1fixed 20.10.6_ce-98.66.1
In containerd (an industry-standard container runtime) before versions 1.3.10 and 1.4.4, containers launched through containerd's CRI implementation (through Kubernetes, crictl, or any other pod/container client that uses the containerd CRI service) that share the same image may
- CVE-2021-21284Feb 2, 2021affected < 19.03.15_ce-98.60.2fixed 19.03.15_ce-98.60.2
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability involving the --userns-remap option in which access to remapped root allows privilege escalation to real root. When using "--userns-remap", if the root user in the remapped namespace has access to the host filesy
- CVE-2021-21285Feb 2, 2021affected < 19.03.15_ce-98.60.2fixed 19.03.15_ce-98.60.2
In Docker before versions 9.03.15, 20.10.3 there is a vulnerability in which pulling an intentionally malformed Docker image manifest crashes the dockerd daemon. Versions 20.10.3 and 19.03.15 contain patches that prevent the daemon from crashing.
- CVE-2020-15257Dec 1, 2020affected < 19.03.14_ce-98.57.1fixed 19.03.14_ce-98.57.1
containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified tha
- CVE-2020-12912Nov 12, 2020affected < 24.0.7_ce-98.103.1fixed 24.0.7_ce-98.103.1
A potential vulnerability in the AMD extension to Linux "hwmon" service may allow an attacker to use the Linux-based Running Average Power Limit (RAPL) interface to show various side channel attacks. In line with industry partners, AMD has updated the RAPL interface to require pr
- CVE-2020-8695Nov 12, 2020affected < 24.0.7_ce-98.103.1fixed 24.0.7_ce-98.103.1
Observable discrepancy in the RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
- CVE-2020-8694Nov 12, 2020affected < 24.0.7_ce-98.103.1fixed 24.0.7_ce-98.103.1
Insufficient access control in the Linux kernel driver for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
- CVE-2020-15157Oct 16, 2020affected < 19.03.15_ce-98.60.2fixed 19.03.15_ce-98.60.2
In containerd (an industry-standard container runtime) before version 1.2.14 there is a credential leaking vulnerability. If a container image manifest in the OCI Image format or Docker Image V2 Schema 2 format includes a URL for the location of a specific image layer (otherwise
- CVE-2020-13401Jun 2, 2020affected < 19.03.11_ce-98.54.1fixed 19.03.11_ce-98.54.1
An issue was discovered in Docker Engine before 19.03.11. An attacker in a container, with the CAP_NET_RAW capability, can craft IPv6 router advertisements, and consequently spoof external IPv6 hosts, obtain sensitive information, or cause a denial of service.
- CVE-2019-19921Feb 12, 2020affected < 20.10.6_ce-98.66.1fixed 20.10.6_ce-98.66.1
runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vul
- CVE-2014-8179Dec 4, 2019affected < 1.8.3-49.1fixed 1.8.3-49.1
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 does not properly validate and extract the manifest object from its JSON representation during a pull, which allows attackers to inject new attributes in a JSON object and bypass pull-by-digest validation.
- CVE-2014-8178Dec 4, 2019affected < 1.8.3-49.1fixed 1.8.3-49.1
Docker Engine before 1.8.3 and CS Docker Engine before 1.6.2-CS7 do not use a globally unique identifier to store image layers, which makes it easier for attackers to poison the image cache via a crafted image in pull or push commands.
- CVE-2019-16884Sep 25, 2019affected < 19.03.5_ce-98.51.1fixed 19.03.5_ce-98.51.1
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
- CVE-2019-14271Jul 29, 2019affected < 19.03.1_ce-98.46.1fixed 19.03.1_ce-98.46.1
In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.
- CVE-2019-13509Jul 18, 2019affected < 19.03.1_ce-98.46.1fixed 19.03.1_ce-98.46.1
In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non
- CVE-2018-15664May 23, 2019affected < 18.09.6_ce-98.40.1fixed 18.09.6_ce-98.40.1
In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do
- CVE-2019-5736Feb 11, 2019affected < 18.09.1_ce-98.34.2fixed 18.09.1_ce-98.34.2
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new conta
- CVE-2019-6486Jan 24, 2019affected < 18.09.6_ce-98.37.1fixed 18.09.6_ce-98.37.1
Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.
- CVE-2018-16875Dec 14, 2018affected < 18.09.1_ce-98.34.2fixed 18.09.1_ce-98.34.2
The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates
Page 2 of 3